Disk encryption is a special case of data at rest protection when the storage media is a sector-addressable device (e.g., a hard disk).

learn more… | top users | synonyms

3
votes
1answer
34 views

How can AES-CBC be used for LUKS encryption, when the ciphertext is not static?

In CBC mode of operation, ciphertext from previous block is used as IV in next block. How then can AES-CBC be used for disk encryption (LUKS), when the data on the disk (ie the ciphertext) keeps ...
3
votes
1answer
102 views

Is there readily available encryption algorithms for current computers, that is safe from quantum computers?

Is there readily available encryption algorithms for current computers, that is safe from quantum computers? I know a bunch of currently popular encryption algorithms that are safe from current ...
1
vote
1answer
55 views

What is the best practice to secure an unattended Raspberry Pi?

I'm working on a project which involves mounting a Raspberry Pi on a self-moving vehicle. I'm looking for the best way to encrypt the Pi (entire file-system, swap, etc.), with the minimum possible ...
2
votes
1answer
118 views

Can Windows BitLocker encryption be broken by Live Boot?

I have a Windows system and I protected the drive with BitLocker encryption. Can BitLocker encryption be bypassed by live-booting with Linux or any other OS?
7
votes
1answer
90 views

Methods of cold boot attacks in the wild

As far as I know, there are two methods for performing cold boot attacks: Reboot the system into an alternate operating system or BIOS with a minimal memory footprint which automatically exports ...
1
vote
1answer
46 views

What does “8.11 Encrypt or sign files into an archive” do?

I am going through the GnuPG manual and I want to encrypt a folder which, if my laptop was taken by anyone else, noone would be able to get access to for any of my information. This man page gives me ...
2
votes
1answer
41 views

How well does FDE protect against disk firmware malware?

In early 2015 news broke that the NSA was installing firmware backdoors in many hard drives. I was wondering, if there was a BIOS and Hard Drive backdoor how well would full disk encryption protect ...
4
votes
1answer
444 views

How to encrypt an entire portable HDD, so that it cannot be read/written without the password for it?

I use a portable USB drive (Seagate FreeAgent Go Flex) to keep all my personal stuff, and though the HDD company does offer a password scheme to control access to it, that would work only on windows, ...
21
votes
1answer
920 views

Linux, TRESOR and XTS

I want to switch from using LUKS for full disk encryption to TRESOR. TRESOR tries to prevent cold boot attacks by storing the encryption key in the CPU's registers. It uses the kernel's crypto API for ...
3
votes
1answer
56 views

How does the MFT encryption work?

A few week ago there was a ransomware called Petya delivered via Dropbox links. The new ransomware is inserted into the master boot record (MBR) of the victim's computer, and the system restarts. On ...
1
vote
1answer
151 views

How to wipe disks before encryption with dm-crypt if CBC or XTS is used internally?

First, please forgive me if I'm posting this question to the wrong community. Feel free to migrate this post to the right community if I was wrong. I'm quite new to whole disk encryption (but not ...
-1
votes
0answers
33 views

encrypted drive

Provided you're trying to mount/read a drive with the corresponding OS/filesystem are you always just prompted with a password to de-crypt the drive? Or do you have to figure out if third party ...
9
votes
3answers
386 views

Linux Plausibly Deniable File System

Is there any way to encrypt a linux filesystem in such a way to maintain plausible deniability? E.g. "Hidden OS support," the way Truecrypt and Veracrypt work, they only support Windows OS due to low ...
1
vote
2answers
169 views

Server full disk encryption protection from malware

A group of LINUX servers is using dm-crypt to encrypt data. The servers do not store data long-term but are only temporary stopping points for data before it is sent to other systems. The time the ...
1
vote
1answer
46 views

Break encryption by applying accidental-overwrite techniques

I read that there are ways, at least on mechanical drives, to sometimes recover data that was overwritten (not just deleted). Now I was wondering if it was theoretically possible to break a fresh ...
2
votes
2answers
103 views

How can I extract the encrypted master key from LUKS header?

I know that a LUKS partition has a plain-text header that stores many informations like master key (MK) digest, MK iterations of PBKDF2, information about the 8 key-slots etc. I also know that in the ...
0
votes
2answers
330 views

Laptop tampering and boot loader

I try to find out how far I can secure my laptop from physical access and tampering attempts. Setup: ThinkPad with Linux installation What I have done so far: disk encryption using cryptsetup for ...
6
votes
1answer
110 views

Method for securely removing files from a solid state drive

I've thought of a method for securely erasing single files on a solid state drive. This method will work only if the drive is encrypted, and it will work even if someone cracks the encryption key for ...
1
vote
2answers
73 views

How secure is a BIOS/UEFI hard drive password? [duplicate]

I'm buying some new machines and am concerned about security of the data should the machine be physically stolen. It's easy to take out the drive, image it, and read what you want. I could use file ...
13
votes
4answers
1k views

Is it possible to prevent a physical attack on full disk encryption?

I've been researching into some methods to ensure that disk encryption keys can't be stolen, and one that I've come across is called TRESOR. With this kernel patch, you can create a partition that is ...
6
votes
3answers
129 views

Android full disk encryption

I am using Android 4.4.4. There is an option called phone storage encryption. From what I have read the crypto is secure. However, I read this article which said Google is able to reset passwords: ...
8
votes
4answers
1k views

What FDE (with hardware encrypted drives) for OS X works?

I'm trying to get all of our laptops doing FDE (as I'm sure lots of you are), and I've run into a problematic spot. Our Windows and Linux laptops are Dells, and they have some good BIOS integration ...
7
votes
1answer
258 views

Does LUKS actually fully encrypt data on a disk?

Why does TrueCrypt and similair applications take hours to fully encrypt a 1 tb drive, while luks takes a few seconds? Sorry if this is a dumb question, but I don't fully understand how that works.
0
votes
1answer
98 views

How do I make my drive fullly protected with bitlocker?

Please note that I am new to BitLocker but I was able to set it up on my C drive. After doing this, I breifly searched on the web for ways around BitLocker and came up with two articles, Passware Hard ...
-4
votes
3answers
104 views

Is there a way to secure a Linux machine in a way that no one else (but me) can access its contents? [closed]

And I mean, even if someone tries rooting with a Live CD, even if one takes the HDD away and plug it in somewhere else, etc... I want to be able to give a client a machine with a service running, but ...
5
votes
3answers
4k views

How To Recover EFS Cert From Backup?

I made a backup of the old Win 7 Pro then did a clean install. But I forgot to export my EFS encryption certificate, so when after I restored the encrypted files from backup I could no longer access ...
3
votes
2answers
54 views

Is VeraCrypt encryption of VHDX correct?

I have created a dynamically expanding vhdx of 500GB to store my backups to - I have decided not to create a 500GB container due to time it would take to create one. I have encrypted the drive ...
22
votes
5answers
22k views

Multi-boot with full hard drive encryption and pre-boot authentication

How would I set up a multiboot system which supports full hard drive encryption and pre-boot authentication. I have a system with Ubuntu, Windows 7, Windows XP, and I would like to install Red Hat. ...
1
vote
1answer
36 views

What threats are mitigated in drives encrypted by USB-SATA bridge?

Some external HDDs (notably, WD Essentials) are known to be encrypted by the USB-SATA bridge present in their case: Essentials drives are hardware encrypted. The USB-SATA bridge board is required ...
-1
votes
1answer
76 views

How do I change LUKS backend to OpenSSL?

I know there is a way to do it, but I don't know how to do it: the default backend for LUKS is libgcrypt and I want to test it with the openssl cryptographic library. I was told that there is a ...
7
votes
2answers
177 views

Can BTRFS provide authentication on an encrypted disk?

One of the problems of disk encryption is providing authentication. An attacker with access to the ciphertext can modify the ciphertext at will without consequence. Given, this isn't a likely attack, ...
41
votes
5answers
27k views

Is there a reason to use TrueCrypt over VeraCrypt?

I am looking to encrypt a few drives of mine, and my ONLY interest is security. It is OK if my VeraCrypt volumes are not compatible with TrueCrypt, and vice versa. There is a lot of talk about ...
0
votes
0answers
57 views

What is the fast way to delete a VeraCrypt volume?

A software (such as BleachBit) can wipe data in a file. But it takes time. For a VeraCrypt volume, can we just wipe the volume header (including the backup header)? If so, how to do that? ...
0
votes
2answers
71 views

How does zeroing out/wiping your disk before encrypting it increase op-sec?

I'v been doing some research and it seems it is recommended to zero out / wipe / overwrite the disk before full disk encryption. Why would that be necessary even when encrypting the entire disk?
3
votes
1answer
221 views

Windows Phone 8.1 Forensic Artifacts

I cannot find any potential tool or technique to do windows phone 8.1 forensics after lot of searching. I tried to make the image (.dd) of windows phone 8.1 with Linux commands but it fails, ...
0
votes
2answers
176 views

Why should one bother encrypting the harddisk in linux if one can easily recover the root password?

If you have physical access to a machine, it's pretty straightforward to recover the root password thereby skipping the whole point of having an encrypted drive. Am I missing something here? EDIT: ...
1
vote
2answers
88 views

Creating a secure offsite backup at a friend's house

A friend has kindly allowed me to store a hard drive at his house to use as an offsite backup. I normally use rsync-backup to make backups of my home directory and have always done this (just being ...
3
votes
1answer
107 views

What's the point of encrypting /boot or / partition?

I'm not talking about full disk hardware encryption. I'm talking about software encryption. encrypting /home prevents your data after your laptop is stolen. As far as I understand, encrypting / and ...
0
votes
1answer
127 views

Online vs offline backups [closed]

Up to this point I was using physical hard drives for backups, typically using dm_crypt as mentioned here. If online storage is used instead, and the provider cannot be trusted how much should the ...
2
votes
1answer
105 views

How safe is Apple's FileVault full disk encryption?

I have read about this encryption feature for OS X but want to know how secure it is compared to PGP.
3
votes
1answer
87 views

Is the Windows paging file safe in the encrypted partition?

I came across this setting called ClearPageFileAtShutdown. The setting is described here and says: If you are truly worried about security, boot Windows off a fully-encrypted drive. Then you ...
0
votes
1answer
168 views

How to secure (encrypt, password protect) external hard drive used with Windows 7 and 10? [closed]

How can I secure (encrypt, password protect) a portable external hard drive (500GB, NTFS) I use on a couple of different computers (not simultaneously): one computer is my work Windows 7 laptop, the ...
0
votes
0answers
37 views

Accessible data when hard-drive is encrypted

I recently acquired a new computer so I decided to try a few things, such as disk-encryption (fir the record, I installed Ubuntu 15.10, made only one partition, wiping everything that was here). I ...
0
votes
1answer
129 views

Encrypting the System Infrastructure

The requirements are to Encrypt the data in our servers 'at rest' and the 'database' - in short the whole infrastructure. Threat Model - to protect a possible data-breach by an adversary (or from ...
5
votes
3answers
134 views

Full Disk Encryption and Network security

I very recently had a job interview in which the interviewer asked me how full disk encryption helped improve network security? Initially I believe they are seperate and not linked, FDE is local to ...
8
votes
3answers
397 views

what does LUKS header contain?

What is contained inside the LUKS header ? I know, the header has size of 2MB. Also, cryptsetup supports "detached header", where the header can be stored in a separate file. Thus, for example, I can ...
0
votes
2answers
53 views

Is there a full-disk-encryption OR file-encryption solution where a trojan can NOT extract the secret key (e.g. from RAM)?

Is there a full-disk-encryption OR single-file-encryption solution like an operating system or a combination of devices or services ... that make sure that the master-decryption-key can NOT be ...
-1
votes
2answers
96 views

Which is more secure a full disk or file encryption? [duplicate]

There are probably two ways to encrypt your computer full disk encryption which completely locks down the computer between when it is off and when it has booted but after everything loads you computer ...
3
votes
3answers
149 views

File encryption on a solid state drive

It seems a lot of computers are switching to solid state drives, and one of the downsides of this is that it seems to make encryption of individual files basically useless, because when you encrypt a ...
3
votes
1answer
103 views

Laptops SSD: Hardware Encryption plus DM-Crypt/Luks - Security and Performance

I just bought a new Thinkpad t450s, and put a Samsung 850 pro in it. My Cpu supports AES-NI and the SSD supports hard-ware based encryption. My question is, is there any reason to do Both ...